coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retain verified tenant provenance and reconcile production blockers

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-fdbf-7b93-a267-5f72b9b24526
This commit is contained in:
tegwick 2026-10-04 11:26:32 +02:00
parent 931e0b3249
commit c9ad5c2dd7
12 changed files with 274 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/storage-operations.md
View file

@ -78,3 +78,19 @@ and verify the existing backup before migration. The old v3 image must not serve
a v5 database; rollback requires the matching pre-migration backup and the
existing single-writer recovery procedure. No live database is migrated by the
source test run.
## Schema v6 — verified tenant provenance
`entries.tenant_source` is nullable TEXT, recording only the verified issuer claim
(`directory`, `registration`, or `default`). Missing claims and pre-v6 entries
stay NULL; migration never infers membership or changes bindings, quorum,
human-control declarations, or existing outbox evidence. New issuance/use
threshold evidence retains this field, including null for unknown provenance.
Migration is additive and must precede serving the v6 release. The deployed
schema-v5 image remains pinned; source changes do not migrate production.
Publish/scan and pin the same v6 artifact for both containers, take and verify
the pre-migration backup, and obtain per-change rollout approval. An old v5
server refuses a v6 store; rollback uses the verified pre-migration backup with
the matching release and the stopped single-writer restore procedure above.